AI tools and client data
Is Canva AI safe for client data?
Short answer: Whether Canva AI is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Canva Free and Canva Pro, Canva says a setting stops it training its models on what staff upload to a design, and we did not find which way that setting starts; on Canva Business, Teams and Enterprise, Canva says it does not train its models on what staff upload to a design, by default. Every fact on this page is Canva's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.
See which AI tools your staff usePlan by plan, in Canva’s own words
The AI inside Canva: it writes copy, generates images and edits designs. A practice reaches it while making patient leaflets, client letters and social posts, which means the material uploaded alongside it is sometimes a real document rather than a template.
| What you are asking | Canva Free and Canva Pro | Canva Business, Teams and Enterprise |
|---|---|---|
| Trains the vendor's models by default | It depends on a setting in the account. Canva publishes the setting as the answer rather than publishing which way it starts.“Canva won’t use your user content to improve AI-powered features unless this is consistent with your Privacy Settings.” source, read | No, and Canva extends it to third parties. This is the clearest reason on this page to put a practice on a business account rather than a personal one.“we don’t use your business, team or enterprise content to improve AI-powered features, and we don’t allow third parties to do so either.” source, read |
| How to turn training off | In the account's own privacy preferences, changeable whenever. Which also means it is whatever the person last left it at.“You can manage how we use your data to improve our AI-powered features by visiting your Privacy Settings page…” source, read | Not found in the pages we read. |
| How long data is kept | Not found in the pages we read. | Not found in the pages we read. |
| What an admin can see or control | Not found in the pages we read. | There is nothing for an administrator to set, because Canva has taken the control away on these accounts. That is the strongest version of a default.“For users who have a Canva Business or Enterprise account, you’ll see that this control in the Privacy Settings page is disabled.” source, read |
| Single sign-on | Not found in the pages we read. | Not found in the pages we read. |
| Business Associate Agreement | Not found in the pages we read. | Not found in the pages we read. |
| Where the data is processed | Not found in the pages we read. | Not found in the pages we read. |
An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Canva pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Canva before client information goes near it.
What this means for
The duty does not change because the tool is new. What changes is where the client information ends up.
- Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
- Dental and medical practices. We didn't find a BAA statement in the pages listed below; ask Canva before any patient data goes in. See dental practices.
- CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
- Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
- Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.
How to tell which version your staff use
The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.
1. Ask
Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.
2. Look at the billing and the admin console
This finds what the business pays for. It does not find a personal account, which is the one that matters here.
3. Look on the computers
A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.
Settings to check today
From Canva’s own documentation. Each one is a change somebody can make this afternoon.
- On a personal account, go and look at the privacy preferences rather than assuming. Canva does not publish which way the switch starts.“Your Privacy Settings control whether Canva and our Technology Partners, may use your data to improve our AI services for everyone.” source, read
- Know that using the AI shares your upload with Canva's providers regardless of the training setting. That is how the feature works, not a leak.“You agree and acknowledge that your Input may be shared with our Technology Partners, for the specific purpose of providing you with the functionality.” source, read
- Put the practice on a business account if anything client-specific is going into a design. It is the only plan where the training question is closed.“we don’t use your business, team or enterprise content to improve AI-powered features, and we don’t allow third parties to do so either.” source, read
Worth knowing
- Today's business answer is a product state and not a promise. Canva says it intends to let administrators opt in, so this row is worth re-reading later.“The ability for Business, Teams, and Enterprise Admins to opt in is coming soon, and we’ll let you know when it’s ready.” source, read
- Two practices can be handed the same image. Worth knowing before a generated graphic goes on a letterhead.“Due to the nature of our technology, and artificial intelligence in general, outputs may not be unique, and other users may receive similar Outputs…” source, read
- Canva puts the acceptable-use check on you, before the design is shared rather than after.“You are responsible for ensuring that your Input and Output complies with these terms and our Acceptable Use Policy before using or sharing it.” source, read
Questions we get asked
Is Canva AI safe for client data?
Whether Canva AI is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.
On Canva Free and Canva Pro, Canva says a setting stops it training its models on what staff upload to a design, and we did not find which way that setting starts; on Canva Business, Teams and Enterprise, Canva says it does not train its models on what staff upload to a design, by default.
Every fact on this page is Canva's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.
Does Canva train its models on what we put into Canva AI?
On Canva Free and Canva Pro, Canva says a setting stops it training its models on what staff upload to a design, and we did not find which way that setting starts; on Canva Business, Teams and Enterprise, Canva says it does not train its models on what staff upload to a design, by default.
On Canva Free and Canva Pro: It depends on a setting in the account. Canva publishes the setting as the answer rather than publishing which way it starts.
Canva's own words: "Canva won’t use your user content to improve AI-powered features unless this is consistent with your Privacy Settings." (read 2026-11-03).
On Canva Business, Teams and Enterprise: No, and Canva extends it to third parties. This is the clearest reason on this page to put a practice on a business account rather than a personal one.
Canva's own words: "we don’t use your business, team or enterprise content to improve AI-powered features, and we don’t allow third parties to do so either." (read 2026-11-03).
How long does Canva keep what we put into Canva AI?
On Canva Free and Canva Pro, Canva Business, Teams and Enterprise: Not found in the pages we read.
Can an administrator read what we put into Canva AI?
On Canva Free and Canva Pro: Not found in the pages we read. On Canva Business, Teams and Enterprise: There is nothing for an administrator to set, because Canva has taken the control away on these accounts.
That is the strongest version of a default. Canva's own words: "For users who have a Canva Business or Enterprise account, you’ll see that this control in the Privacy Settings page is disabled." (read 2026-11-03).
Will Canva sign a Business Associate Agreement for Canva AI?
We didn't find a BAA statement in the pages listed below; ask Canva before any patient data goes in.
How do we find out which version of Canva AI our staff are using?
Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.
Sources
Canva’s own pages, with the date each was read. Nothing on this page comes from anywhere else.
All 35 tools, side by side, or run the AI tool risk checker over the ones you know about.
Other tools people ask about
Same question, different answers. The ones in the same category are the ones staff swap between.
Is Grok safe for client data?
General assistant · SpaceXSI
Is ChatGPT safe for client data?
General assistant · OpenAI
Is Microsoft Copilot safe for client data?
General assistant · Microsoft